Re: [gentoo-server] httpd (2.0.55) proxying https to zope's http mangling POST data

[Andy Dustman]

On 3/3/06, Stelian Ionescu <stelian.ionescu-zeus@×××××.it> wrote:
> On Fri, Mar 03, 2006 at 04:31:44PM -0500, Andy Dustman wrote:
> >On 3/3/06, Edward Muller <edwardam@××××××××.com> wrote:
> >> One of our clients has the following setup:
> >> httpd 2.0.55 (Gentoo package 2.0.55-r1)
> >> Zope 2.6.1
> >>
> >> Apache proxies zope for a http and https host via mod_rewrite/proxy
> >>
> >> POSTs going to httpd=>zope via http are fine, posts going to httpd=>zope via
> >> https are not.
> >
> >Yup:
> >
> >https://bugs.gentoo.org/show_bug.cgi?id=121402
> >http://issues.apache.org/bugzilla/show_bug.cgi?id=37145
> >
> >Unfortunately for you and me, despite having the patch available from
> >upstream, the developer closed the bug with the comment "2.0.56 should
> >be out real soon now, which addresses this problem." That was a month
> >ago.
> 1) download this patch:
> http://svn.apache.org/viewcvs.cgi/httpd/httpd/branches/2.0.x/modules/proxy/proxy_http.c?p2=%2Fhttpd%2Fhttpd%2Fbranches%2F2.0.x%2Fmodules%2Fproxy%2Fproxy_http.c&p1=httpd%2Fhttpd%2Fbranches%2F2.0.x%2Fmodules%2Fproxy%2Fproxy_http.c&r1=372046&r2=372045&rev=372046&view=diff&makepatch=1&diff_format=u
> to /usr/portage/net-www/apache/files/plone.patch
> 2) add this lines to the src_unpack in apache-2.0.55-r1.ebuild right
> after "epatch ${GENTOO_PATCHDIR}...":
>
> epatch ${FILESDIR}/plone.patch
>
> 3) execute: ebuild /usr/portage/net-www/apache/apache-2.0.55-r1.ebuild digest
> 4) remerge apache-2.0.55-r1
>
> (I'm ssuming that you're using an ~arch apache and that your portage
> tree is in /usr/portage; alternativerly you might copy the ebuild to an
> overlay and add the patch there)

Actually, I just found a workaround. I saw something about
mod_security, and thought that by adding that as an intermediate
processing layer, it might fix the problem, and it does.

1) emerge mod_security

2) edit /etc/apache2/modules.d/99_mod_security.conf to suit, and in
particular, you must comment out this rule:

    # Forbid file upload
    #SecFilterSelective "HTTP_CONTENT_TYPE" multipart/form-data

Otherwise, you can't submit POST form data.

3) add -D SECURITY to the args in /etc/conf.d/apache2

4) /etc/init.d/apache2 restart

BTW, it's not a Plone- or Zope-specific problem. It can happen anytime
you are using mod_ssl to mod_proxy and have multi-part form data.
--
The Pythonic Principle: Python works the way it does
because if it didn't, it wouldn't be Python.

-- 
gentoo-server@g.o mailing list